[bigiain]

> Postal mail is insecure yet companies and services like to rely on it as the authoritative form of notice and communication.

From another perspective though - while not "secure against manipulation", at least postal mail has federal laws with serious punitive remedies, and investigators who seem to genuinely be committed to enforcing those laws and chasing the penalties.

Most things in the real world are not "4096 bit cryptographically secured, guaranteed unbreakable before the heat death of the universe", instead they're "secured by people with guns, courts, and jails who are society's deterrence against smashing fragile windows, picking flimsy locks, and fraudulently filling out paperwork".

It _mostly_ works.

And in some ways, the "fiction of security backed by laws with teeth" works _better_. I locked myself out of my apartment recently, and my friend with my spare keys was on a trip ~800km away. So I called a locksmith, who got through the two locks on my front door in ~90 seconds. I'm _very_ glad he could, even though the tool he used is easily available on AliExpress for ~$25...

[heartbreak]

> investigators who seem to genuinely be committed to enforcing those laws and chasing the penalties.

There are some pretty incredible stories about the USPIS.

https://en.wikipedia.org/wiki/United_States_Postal_Inspectio...

[runesoerensen]

They also have a pretty incredible TV show https://www.youtube.com/watch?v=21G3vCXOIAc

[RugnirViking]

Could you post a link to such a story? I'd love to read about it. Unfortunately the wikipedia article doesn't seem to have many leads for me just yet.

[mjcl]

A short story about the USPSIS:

I was downloading Postal Service mp3s from Kazaa and ended up downloading some USPS disciplinary reports on accident. I shared them with a friend because I thought they were funny, and he posted excerpts on a message board. From there it somehow got to the USPSIS who tracked down my friend’s cell phone #. I eventually agreed to meet, so the inspector flew out from DC and met us at a diner in Santa Cruz. He showed us his badge and went over how I ended up with the files. The whole thing was sort of bizarre, but he was pretty friendly and seemed more interested in figuring out how the files got out than throwing the book at me or my friend.

[chrischen]

Wow they flew across country to discuss over dinner something they could have just emailed/phoned about? They really do have a pretty boring job.

[AmericanChopper]

>at least postal mail has federal laws with serious punitive remedies

ACH is also laughably insecure, the only thing standing between it and total chaos is federal prison.

[opinionator1]

Sure, whatever you say. One of my bitcoin-addled friends loves to claim this. I left $1000 in an account and gave him the routing and account numbers and welcomed him to take it. He couldn't do it.

[AmericanChopper]

Then he was not very clever. Account + routing number can be used to make a payment to any merchant that accepts ACH payments. At the very least he should have been able to pay his credit card or utilities with it, without any technical knowledge at all.

If you have a merchant account, you can take direct debits from and account using those numbers. Getting a merchant account underwritten for yourself can take less than a day, and the verification process isn’t all that robust.

Account numbers are essentially more valuable than credit card numbers. Except credit card numbers are at least supposed to be protected by a rather decent security standard. With ACH there is no such standard, you can handle account numbers any way you please, and many merchants do so very poorly. Also, the account number is written on checks that you literally hand out to people, which is pretty much the worst thing you could do with a credit card number.

Your anecdote is meaningless. Any individual can easily commit fraud with an account number, and if they put a small amount of effort into it, they could do it on a very large scale. There is no security standard that protects ACH data, only a short set of regulations that describe how committing fraud will send you directly to prison.

[matte_black]

What tool did he use? Bump keys? A raker?

[Zak]

I do a bit of lockpicking as a hobby and often carry lockpicks because they've come in handy several times when people lost keys, etc....

Most door locks and deadbolts in the US will fall to rakes in a minute or less. I've found the Southord L-rake and Pagoda to be pretty effective. These can be had in basic versions without much of a handle from southord.com for $1.65. (A tension tool is also required; it's pretty much just a bent piece of steel).

[bigiain]

It looks like it's called a "lock gun", that's what I found them called when I went looking for one on Ali Express. Just a little plastic pistol-grip handled tool that he selected a metal blade on and stuck in in the keyway and pulled the trigger as he wriggled it around and twisted it. The first lock took him 2 tries at the right blade and took him a minute or so, then second lock he got the right blade first try and was in in under 30 secs...

I kinda knew "ordinary domestic locks" weren't very secure agains skilled lockpickers, and I don't know if there's some hidden technique required to use those things - but I was astounded and dismayed at how quickly my two different locks fell to such an easily available tool...

[PascLeRasc]

It's not like the system he was cracking was very secure. It has to be regularly openable with just a piece of metal, with tolerances so that when your key teeth wear down over the years it still works.

[Zak]

A pin/tumbler lock can be made considerably more secure against the attacks that work very quickly than most of the ones found on houses in the US actually are. Simply using security pins will significantly reduce the effectiveness of lockpick guns, rakes and bump keys.

In short, standard pins in locks only have one place they're likely to stick when manipulated under tension: the shear line that allows the lock to open. Security pins have additional grooves machined into them that will make the pin stick at points that do not result in the lock opening. It's still possible to pick locks that have them, but it often needs to be done one pin at a time, which is usually slower and tends to require more skill.